What is Akira ransomware?

Akira is a ransomware operation first seen in March 2023 that targets businesses and critical infrastructure in North America, Europe and Australia. CISA, the FBI, Europol's cybercrime centre and the Netherlands' NCSC described it in joint advisory AA24-109A of 18 April 2024: by 1 January 2024 it had affected over 250 organisations and claimed about 42 million US dollars in proceeds. An update on 13 November 2025 raised that figure to about 244 million US dollars as of late September 2025 and listed manufacturing, education, IT, health care, financial services, and food and agriculture among the sectors most often hit. Akira affiliates commonly get in through VPN accounts without multi-factor authentication and through known flaws in VPN and firewall products, the update naming a SonicWall vulnerability among them, and they steal data before encrypting. The advice follows directly: MFA on every VPN account, prompt patching of edge devices, and offline backups.

← All 25 questions on Ransomware groups and familiesAll topics